Did My Website Get Hacked?

bysharoncl

1.5K followers

6 years ago

I'm writing this post to possibly alert people to something I had no idea about, so hopefully it can be of some help to someone else.

So the other day in site content I finished a post and went to publish it, I chose a website and then chose a user just like I normally do, like I had done the very day before, only this time there was another user there.

At first I was shocked, how could there be another user registered on my website? It didn't make any sense.

My first thought was one of being hacked, I know it wasn't there the day before so I logged into my website to see if it was on there as well and sure enough there it was with full administrator priviledges.

Not sure if I done the right thing, but I deleted it straight away and changed the login password.

I searched on here to see if anybody else had ever had a similar experience, but couldn't find anything so decided to do a bit of digging.

I found a website that was disscussing the exact same thing and they had an explanation for it and a way to fix it.

It's very simple and turns out to be a setting in your WP dashboard. If you go to 'settings > general' you'll then see this:

It's that membership box where it says 'anyone can register' that you have to make sure IS TURNED OFF unless you want it on so people can register, if that is the case then that other box will need to be set to what level of access you want to give people.

Now I have no idea why my membership box was turned on, but checking my other sites I found that another one had it turned on, so I turned that off as well.

You might be asking HOW did they register in the first place? Well with that box turned on it's really very easy.

This link here will take you to the registration page,

http://www.yourdomain.com/wp-login.php?action=register Just change yourdomain with....... well, your domain :)

you then just simply add a username and email where you'll then be emailed a password link where you set your own password.

I've tried this on a number of sites (not WA) and have gained access. I have obviously emailed the owners to let them know.

I would say go check your site now just to make sure :)

I hope this has been of some help to you

Sharon